Browser Extension Privacy Policy

1.Who we are and what this policy covers

This policy explains how Osmicro Networks Pty Ltd (ACN 642 841 638 / ABN 70 642 841 638), trading as Vukorix (Vukorix, we, our, or us), handles personal information in connection with the Vukorix browser extension for Chrome (the extension).

It covers the extension and nothing else. Your Vukorix account, the marketing site at vukorix.com.au, and everything you do at app.vukorix.com remain governed by the main Vukorix Privacy Policy. Where this policy is silent, the main policy applies. Where the two differ in how they describe the extension, this one governs.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Vukorix is the controller of personal information about our account holders (you), and a processor of the content you choose to secure through the extension, including any personal information it contains about your clients or recipients.

Our registered office is in New South Wales, Australia. Our Privacy Officer can be reached at privacy@vukorix.com.

2.What the extension does

The extension does two things, and both of them begin with you pressing a button.

2.1 From any page

You click the Vukorix icon in your browser toolbar and a window opens. You type a message, attach files, or both. When you choose to create the link, the message and any files are sent to Vukorix over an encrypted connection, stored encrypted, and a secure link is returned to your clipboard.

From there you can paste the link wherever you like, or ask Vukorix to email it — either to an address you type, or to a contact saved in your Vukorix account. If you ask for that, Vukorix sends that one short email containing the link. It is sent by Vukorix, from Vukorix, and it never passes through your mailbox.

2.2 In Gmail and Outlook on the web

On Gmail and on Outlook on the web, the extension adds a Secure with Vukorix button beside Send. Nothing happens until you press it.

When you do, the extension reads the message you are composing at that moment: the body text you have written, the addresses in the To, Cc and Bcc fields, and any files you have attached to that draft. It turns them into an encrypted link, replaces the body of the draft with that link, and leaves your signature where it is. The addresses in the compose window are recorded as the recipients of the link.

You then press Send yourself, in your own mail client, from your own account. Vukorix does not send that email. We hold no ability to send mail from your mailbox. If you change your mind, Undo restores the draft exactly as it was, and the link is discarded.

The extension works with Gmail and with Outlook on the web, in Chrome. It does not work with the Outlook desktop application, Apple Mail, or any other mail program, and it is not installed into them.

3.What the extension never does

• It does not read your mailbox. It has no access to your inbox, your sent mail, your archive, your folders, your labels, or the contacts held in your Gmail or Outlook account. It reads one thing: the draft in front of you, at the moment you press the button.
• It holds no connection to your Google or Microsoft account. The extension does not use the Gmail API, the Microsoft Graph API, or any OAuth sign-in to Google or Microsoft. It never asks you to sign in to either, and it holds no token that could reach your mailbox. It works inside the web page you already have open, and only when invoked.
• It does not run on other sites. Outside Gmail, Outlook on the web and Vukorix's own domains, the extension does not run, does not read page content, and does not record anything.
• It does nothing on its own. Every action it takes follows a click by you. It has no background behaviour that reads, uploads, or transmits your content.
• We do not sell your personal information, and we do not share it with advertisers, data brokers, or ad networks.
• We do not use it for advertising or profiling, and the extension sets no advertising or cross-site tracking cookies.
• We do not use the content you secure to train machine-learning or artificial-intelligence models.

Limited use. Information the extension handles is used only to provide and improve the features described in section 2, together with the security, support, billing and legal purposes set out in section 7. It is not transferred to anyone other than the sub-processors listed in section 9, and only for those purposes, or where we are required to disclose it by law.

4.Permissions, and why each one is needed

Chrome asks you to approve the following access when you install the extension. Each one exists for a single, stated reason.

The extension requests no other permissions. It does not ask for access to your browsing history, your bookmarks, your downloads, your location, your camera or your microphone, and it does not request access to the other websites you visit.

5.Information the extension handles

5.1 Content you choose to secure

The message text you write, the files you attach, and — in Gmail and Outlook — the recipient addresses in the compose window. This is Customer Content as defined in the main Privacy Policy, and we act as a processor for it. It is sent to Vukorix only when you create a link, and never before.

5.2 Delivery and access records

For each link created through the extension we record: the addresses it was issued to, the expiry you chose, whether an access PIN was set, when the link was opened, and the IP address it was opened from. This is the record you can produce later to show what you sent and what happened to it.

If you set a PIN, it is shown to you in the extension and is deliberately not written into the email. Pass it to your recipient by another means.

5.3 Account and connection information

Which Vukorix account and which connection key created each link, and the version of the extension, browser and operating system in use. We use this to operate the service, to support you, and to investigate faults and abuse.

5.4 Diagnostic information

Error and crash reports covering what failed and where. These do not include the content of your drafts or your files.

5.5 Sensitive information

We do not seek sensitive information (such as information about health, race, political opinions, or religious beliefs). You may choose to include such information in the content you secure. If you do, it is stored encrypted and treated with the same protections as other Customer Content, but you are responsible for obtaining any consents required to send it.

6.Information stored on your own device

The extension keeps a small amount of information in your browser's extension storage, on your computer:

• Your connection key, so that you do not have to reconnect the extension each time you use it.
• An unsent draft. If you leave the extension window before creating a link — switching tabs to look up an address, for instance — what you have typed is kept for ten minutes so it can be put back when you return, and is then discarded. During those ten minutes it stays on your computer. It is not sent to Vukorix unless and until you create the link.
• Small preferences, such as the expiry period you last chose.

None of this is synchronised to us. It is removed when you remove the extension from Chrome.

7.How we use this information

• Provide the service: create, encrypt, store, serve and expire the links you make, and enforce the expiry and PIN you set.
• Deliver a link when you ask us to: send the short notification email described in section 2.1.
• Keep your record: maintain the delivery and access records described in section 5.2, so you can show what was sent and what happened to it.
• Security: detect, investigate and prevent fraud, abuse, unauthorised access and security incidents, and scan uploaded files for malware.
• Support: answer your enquiries and resolve faults.
• Product improvement: understand how the extension is used and diagnose errors, relying on aggregated and de-identified data wherever possible.
• Legal compliance: comply with laws, respond to lawful requests from regulators or courts, and enforce our Terms.

8.How content is protected

Content created through the extension is protected the same way as content created in the Vukorix web application:

• In transit: all traffic between the extension and Vukorix is protected with TLS 1.2 or higher.
• At rest: message text and file payloads are encrypted with AES-256-GCM under a Vukorix-managed key, hosted in Australia (Sydney).
• Access control: the link enforces the expiry you chose, the access limit, and the PIN if you set one. When a link expires or reaches its access limit, the stored content is permanently deleted.

An important limitation. Content secured through the extension uses Vukorix Standard encryption. We do not claim that it is end-to-end encrypted, or that Vukorix systems cannot access it. Delivering, scanning and expiring content requires our systems to process it. Where browser-side encryption is available on other Vukorix products, it is described on the Security page, and this page will be updated if and when it applies to the extension.

9.Sharing and sub-processors

We do not sell your personal information and we do not share it with advertisers. We share it only with the sub-processors below, each under a written contract requiring appropriate data protection, and with professional advisers, authorities where we are required to disclose by law, and an acquirer in connection with a sale of the business, on the terms set out in the main Privacy Policy.

We share nothing with Google or Microsoft. The extension runs inside their web pages, but it sends them no content, no recipient addresses, and no record of what you have secured.

The extension itself contains no analytics or advertising software. Google Analytics runs on the vukorix.com.au marketing site only, as described in the main Privacy Policy.

10.How long information is kept

11.The connection key

The extension connects to your account with a key that you create once, in Settings in your Vukorix account, and paste into the extension. You are never asked for your Vukorix password in the extension.

The key can do one thing: create secure links in your account. It cannot read your documents, open your existing shares, change your account settings, see your billing details, or create another key.

You can revoke it at any time from Settings. The extension stops working immediately and no further links can be created with it. Links already created are not affected by revoking a key — if you want that content gone as well, expire those links from your account.

12.Removing the extension and deleting your data

• Remove the extension from chrome://extensions. Everything held on your device, including your connection key and any unsent draft, is removed with it.
• Revoke the connection key in Settings, so it can no longer be used even if the extension is still installed somewhere.
• Expire or delete individual links from your Vukorix account. The stored content is permanently deleted.
• Delete your account, which removes account information on the timetable set out in the main Privacy Policy.

If you would rather we did it, email privacy@vukorix.com and we will act on your request.

13.International transfers

Content secured through the extension is hosted in Australia (Sydney). Some sub-processors listed in section 9 process data in the United States or other countries.

Where personal information is transferred out of the country in which you are located, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), or on exemptions permitted by applicable law. For personal information of individuals in Australia, transfers out of Australia are made in accordance with Australian Privacy Principle 8, and we take reasonable steps to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles.

14.Your rights

You have the same rights over information handled by the extension as over any other information we hold about you: to access it, to have it corrected, to have it deleted, to object to or restrict certain processing, and to receive it in a portable form. Those rights, how to exercise them, and the legal bases we rely on are set out in full in the main Privacy Policy.

To exercise any of them, email privacy@vukorix.com. We will respond within 30 days.

15.Children's privacy

The extension is a tool for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16 through it. If you believe a child has provided us with personal information, contact privacy@vukorix.com and we will delete it.

16.Changes to this policy

We may update this policy as the extension changes. The effective date at the top of the page always shows the current version. Where a change materially affects how we handle your information, we will tell you by email or through the Service before it takes effect.

17.Complaints and contact

If you have a question, concern, or complaint about how the extension handles your personal information, please contact our Privacy Officer first so we have the chance to put things right:

Privacy Officer, Osmicro Networks Pty Ltd
ABN 70 642 841 638
Email: privacy@vukorix.com
General support: support@vukorix.com

We aim to acknowledge privacy complaints within 5 business days and provide a substantive response within 30 days.

If you are not satisfied with our response, you may lodge a complaint with:

• Australia: Office of the Australian Information Commissioner (oaic.gov.au)
• United Kingdom: Information Commissioner's Office (ico.org.uk)
• European Economic Area: your local data protection authority.